From 0a26f88312a752a9ca96adad8424ea7f6229ee38 Mon Sep 17 00:00:00 2001 From: indexzero Date: Tue, 30 Jun 2026 15:39:25 -0400 Subject: [PATCH] ci: install npm >=11.5.1 so pnpm can do OIDC trusted publishing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 2.0.0 publish reached the registry and signed provenance, but the final PUT returned E404 — pnpm published unauthenticated. `changeset publish` invokes `pnpm publish`, and pnpm delegates the npm OIDC trusted-publishing token exchange to the npm CLI, which must be >= 11.5.1. GitHub's Node 22 runner ships npm 10.x, which can't perform the exchange, so no credentials reached the registry. Install npm@latest before publishing. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a04f71e..b67c30d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -31,6 +31,13 @@ jobs: cache: 'pnpm' registry-url: 'https://registry.npmjs.org' + # `changeset publish` runs `pnpm publish`, and pnpm delegates the npm + # OIDC trusted-publishing token exchange to the npm CLI — which must be + # >= 11.5.1. Node 22 ships npm 10.x, so without this the publish goes out + # unauthenticated and the registry returns E404. + - name: Upgrade npm for OIDC trusted publishing + run: npm install -g npm@latest + - name: Install Dependencies run: pnpm install --frozen-lockfile